3b5a4731f3e52c7217a4e68feaf58cae6c3f0a3e35ea18b924efe9eeae1dec6d

General

Target

PHOTO-DEVOCHKA.exe
Size

150KB
MD5

13064a1549e859958c07462c9b2f0a58
SHA1

da6a8be2da028023ad9a350845eae67a64b5bf7e
SHA256

dd8a4e021d917b7085788dcdf7d881c679a17416493fcf45ebbfedbed0df32ea
SHA512

f28a80bb53fbcb0aed10248a69e7dfbb93671d689d3df6f73eb57b6220348c25cfdb3c0cf2f791aedd44267dba4401d5c0392a2da3f460f25b3509260d2fe533
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hirrmrtA8ujM1jo:AbXE9OiTGfhEClq9dmLsM1E

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2624	WScript.exe
5	2624	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\90909090.ico	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\readme.txt	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.exe	PHOTO-DEVOCHKA.exe
File created	C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.ini	PHOTO-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2664	2724	PHOTO-DEVOCHKA.exe	24
PID 2724 wrote to memory of 2664	2724	PHOTO-DEVOCHKA.exe	24
PID 2724 wrote to memory of 2664	2724	PHOTO-DEVOCHKA.exe	24
PID 2724 wrote to memory of 2664	2724	PHOTO-DEVOCHKA.exe	24
PID 2664 wrote to memory of 2624	2664	cmd.exe	30
PID 2664 wrote to memory of 2624	2664	cmd.exe	30
PID 2664 wrote to memory of 2624	2664	cmd.exe	30
PID 2664 wrote to memory of 2624	2664	cmd.exe	30
PID 2724 wrote to memory of 2696	2724	PHOTO-DEVOCHKA.exe	31
PID 2724 wrote to memory of 2696	2724	PHOTO-DEVOCHKA.exe	31
PID 2724 wrote to memory of 2696	2724	PHOTO-DEVOCHKA.exe	31
PID 2724 wrote to memory of 2696	2724	PHOTO-DEVOCHKA.exe	31

C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat" "
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:2624
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs

Filesize
789B

MD5
fbfaf5456d9016723c58958bbb6fcb99

SHA1
38d0c30b1d89f76a0471f528d6f3536061661a9b

SHA256
22dcf67869a40499096986790585adef290eb556c85077ac1b5a9f5d2f0ef17d

SHA512
537c9b09a96b107cf26a1a2b5aa8a513fed2632b3fdaf932d44fa63b78a1d91bd78cce7c5d7794025785c79091171a52546bb8f42f927cb1072f45873a32f2d6

Download Submit
C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs

Filesize
316B

MD5
9a6686649e0ccb189c6122695cb7acb3

SHA1
925042488d9b06013ee5c1c8372a7980d335fab3

SHA256
f8bcebb93f79463e73675bb1f611debda612e5d48237092aed4604f1da837e69

SHA512
173b08167eff99101732f6b08f7111e1d6c1c998bc9794a93530857cf49183bd651340a592360c2a75b259ee83118b63c25732f01342bb5ada96467dc2e4eed6

Download Submit
C:\Program Files (x86)\dus_dezodorant\mouyus\readme.txt

Filesize
39B

MD5
8cdff5761878e3cf771aea2aa10c1a4e

SHA1
8f7c0e2f1642ae768f3f2f9a45992a1f57c26aba

SHA256
c0c37efa00039b77e1b72d650ef0622c65db937771617ee3f0e3adf7f480360c

SHA512
730c5dd152d8f7a48f5bcda68f10b7f64235938b106479b8340fc3bbe4cfde113219deef03ca7726bcd7c9dfbcd12e4f53c631b20a77a51644ae1c1bc10e0ab4

Download Submit
C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat

Filesize
3KB

MD5
25a0b02e83ef7cc0e50772e9ca8fdbe9

SHA1
5bf8d941645128fc22548c44d1cb9f64b0cfb360

SHA256
fd0e09bfa5c5af35ed2b17b0c3a63740fcf657550fff9a397c1a1f69af246863

SHA512
b15105e92adf78c304e7ccbd2a87946a08897ab10b009643348e7675806646a3159c632f5aa788ee6ca8128cb8f76a3d77aaa49fe6e4d9ee17748b35166562bd

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
44ccd2e0f82c735fbef30c341d6bfc10

SHA1
8cc305f7f8fff401380175ae0cc7d0df99b83373

SHA256
d29b19381fbf3494195232c63a36e6a9d38de4e2db3e80ae3f007a36e9674db3

SHA512
8627b9c13415f5d9c917692281f2a33aa4286f0a50b0d08933ca663cd6cc12fb17256a2270ff283dd497661001b6c06f3d16e889215821659fa24ede367dfe07

Download Submit
memory/2724-72-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing